Lucene search

MitreCVE-2009-1721

HistoryJul 31, 2009 - 7:00 p.m.

CVE-2009-1721

2009-07-3119:00:01

CWE-824

mitre

web.nvd.nist.gov

cve-2009-1721

openexr

code execution

denial of service

vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

High

EPSS

0.005

Percentile

75.6%

JSON

The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.

Affected configurations

Nvd

Node

openexropenexrMatch1.2.2

openexropenexrMatch1.6.1

Node

opensuseopensuseMatch10.0

opensuseopensuseMatch10.3

opensuseopensuseMatch11.0

Node

applemac_os_xRange<10.5.8

Node

debiandebian_linuxMatch4.0

debiandebian_linuxMatch5.0

Node

canonicalubuntu_linuxMatch8.04

canonicalubuntu_linuxMatch8.10

canonicalubuntu_linuxMatch9.04

Node

fedoraprojectfedoraMatch10

fedoraprojectfedoraMatch11

VendorProductVersionCPE
openexropenexr1.2.2cpe:/a:openexr:openexr:1.2.2:::
openexropenexr1.6.1cpe:/a:openexr:openexr:1.6.1:::

Vendor	Product	Version	CPE
openexr	openexr	1.2.2	cpe:/a:openexr:openexr:1.2.2:::
openexr	openexr	1.6.1	cpe:/a:openexr:openexr:1.6.1:::

References

lists.apple.com/archives/security-announce/2009/Aug/msg00001.html

lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.html

release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff

secunia.com/advisories/36030

secunia.com/advisories/36032

secunia.com/advisories/36096

secunia.com/advisories/36123

secunia.com/advisories/36753

security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz

security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz

support.apple.com/kb/HT3757

www.debian.org/security/2009/dsa-1842

www.mandriva.com/security/advisories?name=MDVSA-2009:190

www.mandriva.com/security/advisories?name=MDVSA-2009:191

www.securityfocus.com/bid/35838

www.securitytracker.com/id?1022674

www.ubuntu.com/usn/USN-831-1

www.us-cert.gov/cas/techalerts/TA09-218A.html

www.vupen.com/english/advisories/2009/2035

www.vupen.com/english/advisories/2009/2172

www.redhat.com/archives/fedora-package-announce/2009-July/msg01286.html

www.redhat.com/archives/fedora-package-announce/2009-July/msg01290.html

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

High

EPSS

0.005

Percentile

75.6%

JSON

Related for CVE-2009-1721